hypnguyen1209/offensive-claude

What it solves

This project provides a structured, spec-driven framework for performing offensive security research and penetration testing using Claude Code. It transforms the LLM into a disciplined security researcher by enforcing a rigorous methodology based on the Cyber Kill Chain, preventing shortcuts and ensuring that findings are backed by empirical evidence rather than hallucinations.

How it works

The framework operates as a plugin for Claude Code, injecting a "SessionStart" dispatcher that guides the model through a 9-phase pipeline (from scoping to reporting). It combines several layers of control:

• Orchestration: Slash commands (e.g., /engage.recon) manage the transition between phases and enforce "quality gates" that require specific artifacts (like CWE or CVSS scores) before proceeding.
• Skill Modules: 31 domain-specific skill modules (e.g., web pentesting, cloud security, AI red-teaming) provide the model with technique maps, OPSEC notes, and runnable scripts.
• Safety Guards: Executable Python scripts (like scope_guard.py and action_guard.py) enforce target authorization and redact sensitive headers to prevent out-of-scope actions.
• Verification Pipeline: A specialized "Crash $\rightarrow$ Exploitability" pipeline uses tools like rr and gcov to prove root causes and reachability for native memory corruption bugs.
• Collaborative Agents: Eight specialized sub-agents (e.g., finding-validator, exploit-researcher) collaborate via a generator-checker rebuttal loop to verify findings.

Who it’s for

It is designed for security researchers, penetration testers, and red teamers who use Claude Code to automate and structure their vulnerability research and exploit development workflows.

Highlights

• Cyber Kill Chain Integration: A full 9-phase pipeline with mandatory quality gates.
• Evidence-Based Findings: Requires [EVD-XXX] citations and empirical proof (coverage/trace) for native bugs.
• Executable Safety: Safety controls are implemented as code (guards and circuit breakers) rather than just prompt-based instructions.
• Extensive Knowledge Base: Includes 31 skill modules and a 47-file vulnerability reference library.
• Specialized Tooling: Integrates with MCP servers for IDA Pro, JADX, and web searching.